(19) 



3 



(12) 



Europ&sMKS Patentamt 
Einopeanratent Office 
Office europten des brevets 

EUROPEAN 



■ 



(43) Date of publication: 

1X11*1996 Bulletin 1996/46 



Express Mail Label No. 

(n) EP 0 742 507 A1 

PATENT APPUCATION 

(51) inL a. 6 : G05D 1/00, G06F 1 1/20 



(21) Application number: 95203095^ 

(22) Date of filing: 13.11.1995 



(84) Designated Contracting States: 
DEFRGB 

(30) Priority: 12.05.1995 US 440563 

(71) Applicant: THE BOEING COMPANY 
Seattle, Washington 98124-2207 (US) 

(72) Inventors: 

• Chong, Ray K. 
Mukilteo, Washington 98275 (US) 



• Herald, Richard a. 

Lyimwood, Washington 98037 (US) 

• Gunn, Peter D. 

BeHevue, Washington 98008 (US) 

(74) Representative: Land, Addlck Adrlanus Gosling 
Arnold &Siedsmd, 
Advocaten en Octroolgemachtigden, 
Sweelinckplein 1 
2517 GK DenHaag(NL) 



< 
O 

in 

CM 



Method and apparatus for synchronizing flight management computers 



(54) 

(57) A method and apparatus for choosing which 
flight management computer (FMC) of two FMCs wiD 
function as a master FMC (1 1) and which will function 
as a spare FMC (13) in maintaining data commonalty 
and synchronization between the master FMC (1 1) and 
the spare FMC (13) is disclosed. The status of a control 
switch (15) having FMC select and auto positions is 
scanned to determine the state of the switch. If the 
switch (15) is in an FMC select position, the related 
FMC is chosen to be the master FMC and the other 
FMC is chosen to be the spare FMC. If the switch is in 
the auto position, the failure status of the FMCs is eval- 
uated. If one of the FMCs has failed, the other is chosen 
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to be the master FMC. H the FMCs are both operating, 
the health of the FMCs is evaluated. If both FMCs are 
healthy, one is chosen to be the master FMC and the 
other is chosen to be the spare FMC. in accordance 
with a predetermined protocol. If the health of one of the 
FMCs has degraded, the other FMC is chosen to be the 
master FMC. Only the master FMC receives pilot data, 
which is forwarded to the spare FMC. The master FMC 
maintains object managers and sends changed data to 
the spare FMC when a data change occurs. The spare 
FMC stores the changed data within its own object man- 
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This invention is cfirected to multiple computer sys- 
tems and, more particular, to murtple computer sys- 
tems wherein one computer is a back-up for another 
computer. 

BackgrotMid of the Invention 

Contemporary commercial jet transport airplanes 
include two flight management computers (FMCs) that 
operate in a dual configuration. That is, modem com- 
mercial jet transport airplanes, such as the Boeing 
Model 757, 767 and 747-400 airplanes, include two 
FMCs. The FMCs operate simultaneously in synchroni- 
zation. That is, both FMCs receive, process and com- 
pare both stored data and data entered by the flight 
crew and by flight environmental sensors coupled to the 
FMCs. Data discrepancies between FMCs can trigger 
resynchronization during which FMC operations are 
suspended while the FMCs attempt to reestablish cor- 
rect operational and data agreement During resynchro- 
nization. flight crews are inhtoited. i.e., locked out, from 
entering new and changed data. The lock-out time can 
equal 30 seconds or mora Obviously, a lock-out time of 
this magnitude is unacceptable to airplane pilots. 

Prior attempts to solve the synchronization problem 
have focused on making the FMCs synchronization 
code more robust Whfle this has reduced the number of 
resynchronization events pet flight hour, it has not 
entirely eliminated them. The present invention is 
directed to providing a method and apparatus that elim- 
inates the lock-out problem associated with resynchro- 
nizing current ffight management computer systems. 

Summary of the Invention 

In accordance with this invention, a method and 
apparatus for: (i) automatically or manually choosing 
which flight management computer (FMC) of two FMCs 
wifl function as a master FMC and which will function as 
a spare FMC; and pi) maintaining data commonalty and 
synchronization between the master FMC and the 
spare FMC are provided. In one form of the invention 
the status of a control switch having FMC select and 
auto positions is scanned to determine the state of the 
switch. If the switch is in an FMC select position, the 
related FMC is chosen to be the master FMC and the 
other FMC is chosen to be the spare FMC. If the switch 
is in the auto position, the failure status of the FMCs is 
evaluated. B one of the FMCs has failed the other is 
chosen to be the master FMC. If the FMCs are both 
operating satisfactorily, the health of the FMCs is evalu- 
ated. If both FMCs are healthy, one is chosen to be the 
master FMC in accordance with a predetermined proto- 
col. If the health of one of the FMCs has degraded, the 
other FMC is chosen to be the master FMC. Pilot input 



commonalty is main^w) by forwarding naw data ^ 
from the master FMC to the spare FMC i«xih receipt of 
the new plot input data by the master FMC or when 
prior pilot input data is changed by the master FMC 

5 master FMC and the spare FMC are synchronizjd 
when data is forwarded or if the master FMC and the 
spare FMC become unsynchronized. 

In accordance with alternative aspects of this&wen- 
tion, the control switch can be eliminated whereby a 

10 decision regarding which FMC wffl be chosen as the 
master FMC and w» be chosen to be the spare FMC is 
automatically determined in accordance with the previ- 
ously outlined procedure. 

As will be reacfly appreciated from the foregoing 

75 description the invention provides a new Lnd improved 
method and apparatus for synchronizing ffight manage- 
ment computers. Rather than a pair of FMCs both 
receiving, processing comparing and storing the same 
data simultaneously and independently, only one erf the 

20 FMCs interfaces with the fight crew to receive data. The 
second or spare FMC receives the data from the first or 
master FMC after the data is received by the master 
FMC, rather than simultaneously and independently. As 
required by events, the master and spare FMCs are 

25 synchronized in a way that does not result in a lock-out 
As a result the lock-out problem associated with the 
resynchronization of prior art dual flight management 
computer systems is eliminated. 

so Brief Description of the Drawings 

The foregoing features and aspects of this invention 
will become more readily appreciated as the same 
become better understood by reference to the following 
35 deta3ed description, when taken in conjunction with the 
accompanying drawings, wherein: 

FIGURE 1 is a pictorial, block diagram of two flight 
management computers coupled together in 

40 accordance with the invention; 

FIGURE 2 is a schematic diagram of a control 
switch connected to a pair of FMCs for controlling 
the master/slave determination; 
FIGURES 3A and 3B comprise a flow diagram ilus- 

45 trating how a master/spare determination is made 
in accordance with the invention; 
FIGURE 4 is a block diagram showing how master 
and spare data synchronization subroutines, which 
form the sync protocol, are interrelated; 

so FIGURE 5 is a flow diagram of a master data syn- 
chronization subroutine formed in accordance with 
the invention; and 

FIGURE 6 is a flow diagram of a spare data syn- 
chronization subroutine formed in accordance with 
55 the invention. 
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Detailed De^ n^ p r^f™ d Embedment 

As wffl be better understood from the following 
description, in accordance with the invention, one of two 
ffight management computers (FMCs) is designated a 
master FMC. The other is designated a spare FMC. 
During normaJ operation, the spare FMC receives the 
same p3ot input and sensor input data as the master 
FMC. In addition, the spare receives master FMC syn- 
chronization data. Based on the received data, the 
spare FMC maintains a state of operation similar to the 
master FMC. As a result, transparent/seamless transfer 
of control from the master FMC to the spare FMC can 
occur in the event of a failure of the master FMC or 
flight/maintenance crew override Because only one 
FMC (the master FMC) is in control at any one time (as 
opposed to two FMCs operating in agreement), resyn- 
chronization is not needed and, hence, win not occur. As 
a result, the FMCs are always available to receive data. 

FIGURE 1 is a pictorial, schematic view illustrating 
a master FMC 11 and a spare FMC 13. As is conven- 
tional, both FMCs perform a plurality of functions. While 
not important to the present invention, some functions 
performed by the FMCs are pictorially depicted in FIG- 
URE 1 as object managers entitled lateral guidance 
15a, 15b, vertical guidance 17a. 17b. CDU control 19a 
and 19b. flight planning 21a, 21b. ffight plan 23a. 23b, 
performance calculations 25a. 25b. map generation 
27a, 27b, navigational solution 29a, 29b. FIGURE 1 
also Blustrates left, right and center control/display units 
(CDUs) 31a, 31k and 31c. The left, right and center 
CDUs 31 a, 31 c and 31 b are connected to the CDU con- 
trol 19a of the master FMC 11. The CDU control 19b of 
the spare FMC is shown in phantom because it is inac- 
tive and, as a result, as shown by the dash line, signals 
do not flow from the left, right and center CDUs 31a. 
31b, and 31c to the CDU control 19b of the spare FMC 
1 3. The ffight planning block of the spare FMC 1 3 is also 
shown in phantom because it is inactive. The remaining 
portions of the spare FMC, namely, the lateral guidance 
15b, vertical guidance 17b, ffight plan 23b, performance 
calculations 27b, map generation 27b and navigational 
solution 29b, are all active. Since the functions carried 
out by these blocks as well as the CDU and control and 
flight planring blocks are well known to those familiar 
with FMCs and do not form a portion of this invention, 
they are not described here. 

As shown in FIGURE 1, the navigational solution 
Wocte of both the master and spare FMC 11 and 13 are 
both connected by a summer 33 whose output is 
applied to an annunciator (not shown). In a conventional 
manner, if the navigational solutions independently cal- 
culated by the master and spare FMCs 1 1 and 13 differ 
by a predetermined amount ag., 4 miles, the annunci- 
ation output enables a suitable visual and/or audible 
annunciator. 

The master FMC 11 and the spare FMC 13 are also 
illustrated as including a sync protocol 35 and a sync 
counter 36. The sync protocol is shown in FIGURES 4- 



6 and described below. The sync protocol includes mas- 
ter data and spare data sync hr o niz ation subroutines 
that control the flew of pflot input and sensor data from 
the master FMC 1 1 to the spare FMC and the transmis- 
5 sion of synchronization data between the master and 
spare FMCs 11 and 13. In this regard, as diagrammatic 
cally shown in FIGURE 1, data received by the object 
managers 1 5a. 1 7a. ... of the master FMC 1 1 from one 
of the CDUs 31a, 31b or 31c is forwarded to the object 
io managers 15b, 17b. ... of the spare FMC 13 by the sync 
protocol 35. How the sync protocol controls the transfer 
of data is described below. 

As illustrated in FIGURE 2, preferably, the master 
and spare FMCs 11 and 13 are each connected to an 
15 FMC switch 1 5. The FMC switch 1 5 has three positions, 
a left position, a right position, and an auto position. 
Both the master and spare FMCs 11 and 13 sense or 
detect the position of the FMC switch 15. The position of 
the FMC switch is evaluated by a master determination 
20 program 41 illustrated in FIGURES 3A and 3B and 
described below. The master/spare determination pro- 
gam determines whether an FMC is to be a master 
FMC or a spare FMC. The master/spare FMC status is 
pictorially represented in FIGURE 2 as the state of a 
25 master/spare switch 43 included in the master and 
spare FMCs 1 1 and 13. As pictorially illustrated in FIG- 
URE 2 by solid fines, guidance commands, maprfdis- 
played data. CDU control and other outputs are only 
produced by the master FMC and marked as usable 
30 data As shown by the dashed fines, while these outputs 
are produced by the spare FMC 13. they are not marked 
as available to receiving subsystems. Finally, as wfll be 
better understood from the following description, the 
master/spare determination programs 41 are pictorialy 
35 illustrated as coupled together so that foey can compare 
or vote on the validity of switch position, hearth, failure 
and master/spare status data 

The first step in the master/spare determination 
subroutine illustrated in FIGURE 3A is test 51 to deter- 
40 mine if the FMC switch 1 5 is in the left or right position. 
The test is made after the FMCs compare their witch 
position readings and vote on the state of the witch. If 
in the left position, the left FMC is chosen to be the mas- 
ter FMC and the right FMC is chosen to be the spare 
45 FMC. See block 53. If the switch is in the right position, 
the right FMC is chosen to be the master FMC and the 
left FMC is chosen to be the spare FMC. See block 55. 
tithe position of the FMC switch 15 is unknown or if the 
FMC switch 15 is in the auto position, a test 57 is made 
so to determine if the left FMC has failed. H the left FMC 
has failed, the right FMC is chosen to be the master 
FMC. See block 59. If the left FMC has not failed, a test 
61 is made to determine if the right FMC has failed If 
the right FMC has failed, the left FMC is chosen to be 
55 the master FMC. See block 63.. 

If the right FMC has not failed, a test 65 is made to 
deterrnne if the health of the left FMC is okay (L -FMH 
= OK), the health of the right FMC is okay (R -FMH » 
OK) and if the left FMC is claiming to be the master 
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FMC (L - FM = Master). K sa left A is chosen to 
be the master FMC and the right FMCTschosen to be 
the spare FMC. See block 67. With respect to the left 
FMC claiming to be the master FMC. as will be appreci- 
ated by those familiar with fOght management comput- 
ers, both FMCs coukj claim to be the master FMC if the 
FMCs are energized at about the same time since, on 
power-up, each FMC would not be able to identify the 
other FMC as active and, thus, decide ft was the master 
FMC. Under this set of conditions, the next pass through 
the master/spare determination program shown in FIG- 
URES 3A and 3B would result in the left FMC being 
chosen to be the master FMC and the right FMC being 
chosen to be the spar? FMC as a result of test 65 and 
block 67. 

If the health of one or both of the FMCs is not okay 
andfor if the health of both FMCs is okay but the left 
FMC is not claiming to be the master FMC, a test 69 is 
made to determine if the health of the left and right 
FMCs is okay and if the left FMC is claiming to be the 
spare FMC. H so, the left FMC is chosen to be the spare 
FMC and the right FMC is chosen to be the master 
FMC. See block 71. As with both FMCs claiming to be 
the master FMC. under some conditions, both FMCs 
could daim to be spare FMCs. Under this set of condi- 
tions, the next pass through the master/spare determi- 
nation program shown in FIGURES 3A and 3B would 
resun in the left FMC being chosen to be the spare FMC 
under the right FMC chosen to be the master FMC as a 
result of test 69 and block 71 . 

As shown in FIGURE 3B. if the health of either of 
the FMCs has degraded, a test 73 is made to determine 
if the health of the left FMC has degraded (L • 
FMH=Degraded) and if the health of the right FMC is 
okay (R-FMH=OK). If sa the left FMC is chosen to be 
the spare FMC and the right FMC is chosen to be the 
master FMC. See block 75. Next a test 77 is made to 
determine H the health of the left FMC is okay (L -FMH 
= OK) and the health of the right FMC has degraded (R 
-FMH = Degraded). If so, the left FMC is chosen to be 
the master FMC and the right FMC is chosen to be the 
spare FMC. See block 79. If the health of both the left 
and right FMCs has degraded, a test 81 is made to 
deterrrine if the left FMC is claiming to be the master 
FMC. If so, the left FMC is chosen to be the master FMC 
and the right FMC is chosen to be the spare FMC See 
block 83. If not, the left FMC is chosen to be the spare 
FMC and the right FMC is chosen to be the master 
FMC See block 85. As with tests -5S and 69, test 81 is 
designed to force a master/spare decision in situations 
where both FMCs are claiming to be the master FMC or 
where both are claiming to be the spare FMC. 

As illustrated in FIGURES 3A and 3B, after master 
and left FMCs have been chosen, the program cycles to 
the beginning test and the cyde is repeated. As a result 
any change of the status of the FMC switch, or failure or 
degradation of the master FMC, results in immediate 
transfer of master status from the existing master FMC 
to the spare FMC. 



After a master/spare^ice or selection has been 
made, as shown pctmiJPn FIGURE 2, a software 
switch is set that prevents the spare FMC from receiving 
piot COU irput and sensor data drectly from the CDUs. 
s Rather, as descrtoed below, pflct input data is sent from 
the master FMC to the spare FMC The spare FMC 
independently uses sensor data to determine the 
present state, given the pilot inputs from the master 
FMC. 

10 FIGURE 4 illustrates the sync protocol 35 included 
in the master and spare FMCs 11 and 13 that controls 
the transfer of pfl ot input and sensor data from the mas- 
ter FMC 11 to the spare FMC and the synchronization of 
the spare FMC to the master FMC As shewn in FIG- 

is URE 4, the sync protocol 35 includes a master data syn- 
chronization subroutine 91 and a spare data 
synchronization subroutine 93. A suitable master data 
synchronization subroutine is illustrated in FIGURE 5, 
and a suitable spare data synchronization subroutine is 

20 illustrated in FIGURE 6. 

The master data synchronization subroutine llus- 
trated in FK3U RE 5 begins with a test 1 01 to determine 
if the related FMC is the master FMC or the spare FMC. 
If the related FMC is not the master FMC, the program 

25 shifts to the spare synchronization subroutine illustrated 
in FIGURE 6 and descrtoed below. If the FMC is the 
master FMC. a test 103 is made to determine H the 
other FMC. called the off-side FMC, is aive. The termi- 
nology off-side FMC is used rather than spare FMC 

30 since the other FMC could also be claiming to be the 
master FMC If the off-side FMC is not alive, the on-side 
sync counter is reset (see block 1 05), and the program 
returns to the master FMC test 101. The on-side sync 
counter is the sync counter of the FMC running the 

as master data synchronization subroutine. 

If the off-side FMC is alive, a test 107 is made to 
determine if the on-side sync counter is zero or H the 
count value of the master sync counter does not equal 
the count value of the spare sync counter. If the on-side 

40 sync counter is zero or the master sync counter value 
does not equal the spare sync counter value, sync data 
is sent from the master FMC to the spare FMC See 
block 109. Thereafter, the on-side sync counter is reset 
See block 111. Then, the on-side sync counter is incre- 

45 merited (see block 113), and the program cycles to the 
test 101 that determines whether the FMC is the master 
FMC 

If the on-side sync counter is not zero and the mas- 
ter sync counter value equals the spare sync counter 

so value, a test 1 1 5 is made to determine if a data change 
has occurred in the master FMC That is. a test 115 is 
made to determine ff one or more of the object manag- 
ers of the master FMC has received pilot input data from 
one of the CDUs or data from internal calculations or 

55 state changes If no data change has occurred, the pro- 
gram cycles to the test 101 that determines if the FMC 
is the master FMC. If a data change has occurred, the 
changed data is sent to the spare FMC. See block 117. 
Thereafter, the on-side sync counter is incremented. 
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See block 1 13. Then, the proySncydes to the test 101 Claims 
that determines whether the FMC is the master FMC 

The first step in the spare data synchronization sub- 
routine Bustrated in FIGURE 6 is a test 121 to deter- 
mine if the RtfC is the spare FMC. tf the FMC is not the s 
spare FMC, the program cycles to the master data syn- 
chronization subroutine illustrated in FIGURE 5 and 
descrbed above. H the FMC is the spare FMC, a test 
1 23 is made to determine if off-side FMC is alive. If off- 
side FMC is not alive, the on-side sync counter is reset 10 
See block 125. H off-side FMC is alive, a test 127 is 
made to determine if new data has been received from 
the master FMC. If no new data has been received from 
the master FMC, the program cycles to the test 121 that 
determines whether the FMC is the spare FMC. If new is 
data has been received from the master FMC, the data 
is transmitted to the various object managers illustrated 
in FIGURE 1 and described above. Thereafter, the 
spare FMC sync counter is set equal to the master FMC 
sync counter (see block 131). after which the prog-am 20 
cycles to the test 121 that determines whether the FMC 
is the spare FMC. 

As will be readily appreciated from the foregoing 
description, the invention provides a new improved 
apparatus for synchronizing ffight management corrput- 25 
ers that does not require resynchronization that could 
prevent flight crews from making data entries and 
changes. In accordance with the invention, one FMC of 
a pair of FMCs is chosen to be the master FMC while 
the other FMC is chosen to be the spare FMC. During 30 
normal operation, the master FMC receives pilot input 
and processes ad data and is the controlling FMC. The 
spare FMC receives the same data as the master FMC 
plus master FMC synchronization data. However, the 
pilot input data is received from the master FMC, not ss 
directly from the pilots. Based on the data it receives, 
the spare FMC is able to maintain a state of operation 
similar to the master FMC; however, it is not in control. 
As a result, in the event of failure of the master FMC, 
transparent/seamless transfer of control from the mas- ao 
ter FMC to the spare FMC can take place. Likewise, a 
flight or maintenance crew can readily convert one FMC 
from master FMC status to spare FMC status and vice 
versa without loss of control. Since only one FMC is in 
control at any point in time, as opposed to two FMCs 45 
operating in agreement, resynchronization is not 
required and, hence, wBI not occur. 

While the preferred embod imen t of the invention 
has been illustrated and descrtoed. it will be readily 
appreciated by those skiDed in the art and others that so 
various changes can be made therein without departing 
from the spirit and scope of the invention as defined by 
the appended claims. For example, the FMC select 
switch 15 could be deleted and the FMC master/spare 
determination made entirely automatically, if desired. 55 



1. A method of choosing which flight management 
conputer (FMC) of a pair of FMCs win function as a 
master FMC and which will function as a spare 
FMC and maintaining data commonalty and syn- 
chronization between the master FMC and the 
spare FMC comprising: 

- determining if one flight management compu- 
ter ;FMC) of a pair of FMCs has failed; 

- if one FMC has failed, choosing the other FMC 
to function as a master FMC and the tailed 
FMC to function as a spare FMC; 

- if neither FMC has faOed. choosing one FMC to 
function as a master FMC and the other to 
function as a spare FMC in accordance with 
the predetermined protocol; 
supplying data to the FMC chosen to function 

as the master FMC;* 

- forwarding data received by the FMC chosen to 
be the master FMC to the FMC chosen to be 
the spare FMC; and 

- synchronizing the FMC to be the spare FMC to 
the FMC chosen to be the master FMC. 

2. The method claimed in claim 1. wherein said pre- 
determined protocol includes: 

- determining if said FMCs are healthy; 

- determining if a selected one of said FMCs is 
claiming to be a master FMC; and 

- choosing said selected one of said FMCs to 
function as said master FMC and the other 
FMC to function as said spare FMC if both of 
said FMCs are healthy and if said selected one 
of said FMCs is claiming to be a master FMC. 

3. The method claimed in claim 1 of 2, wherein said 
predetermined protocol includes: 

- if both of said FMCs are healthy and if sad 
selected one of said FMCs is not claiming to be 
a master FMC, determining if said selected one 
of sakJ FMCs is claiming to be a spare FMC; 

- choosing said selected one of said FMCs to 
function as said FMC to function as said spare 
FMC and the other FMC to function as said 
master FMC 9 both of sad FMCs ar healthy 
and if said selected one of sakJ FMCs is claim- 
ing to be a spare FMC; 

- choosing the other of said FMCs to function as 
said master FMC if the health of one of said 
FMCs has degraded and choosing the FMC 
whose health has degraded to function as said 
spare FMC; 

- determining H a selected one of said FMCs is 
claming to be a master FMC if the health of 
both of said FMCs has degraded; and 
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- choosing said selected one oteud FMCs to 
function as said master FM(§Bsd the other 
FMC to function as said spare FMC if the 
health of both of said FMCs has degraded if 
said selected one of said FMCs is claiming to 5 
be a master FMC. 

The method claimed in claim 1, 2 or 3, 
wherein said predetermined protocol includes: 

10 

- choosing the other of sad FMCs to function as 
said master FMC if the health of one of said 
FMCs has degraded and choosing the FMC 
whose health has degraded to function as said 
spare FMC; is 
determining is a selected one of said FMCs is 
claiming to be a master FMC if the health of 
both of said FMCs has degraded; and 

- choosing said selected one of said FMCs to 
function as said master FMC and the other 20 
FMC to function as said spare FMC if the 
health of both of said FMCs has degraded rf 
said selected one of said FMCs is claiming to 

be a master FMC. 

25 

5. The method claimed in any of claims 1-4. 
wherein said predetermined protocol includes: 

determining rf a selected one of said FMCs is 
claiming to be a master FMC if the health of so 
both of said FMCs has degraded; 

- choosing said selected one of said FMCs to 
function as said master FMC and the other 
FMC to function as said spare FMC if the 
health of both of said FMCs has degraded, if & 
said selected one of said FMCs is claiming to 

be a master FMC; and wherein the FMCs 
include sync counters and wherein synchroniz- 
ing the FMC chosen to be the spare FMC to the 
FMC chosen to be the master FMC comprises *o 
each FMC: 

determining rf the determining FMC is a master 
FMC; 

if the determining FMC is a master FMC, deter- 
mining rf the other FMC is alive; 45 
if the other FMC is not alive, setting a sync 
counter in the determining FMC; 
if the determining FMC is not a master FMC. 
determining if the determining FMC is a spare 
FMC; so 

- if the determining FMC is a spare FMC, deter- 
mining rf the other FMC is alive; and 

- if the other FMC is not alive, setting a sync 
counter in the determining FMC. 

6. The method claimed in claim 5 includes the mas- 
ter FMC: 



determining if the sra courts ot the determin- 
ing FMC is zero ^^iiie sync counter of the 
master FMC does not equal the ^ync counter of 
the spare FMC; 

- if the sync counter or the determining FMC is 
not zero, and the sync counter of the master 
FMC equals the sync center of the spare 
FMC; 

- H the master FMC has updated data, serving 
the updated data to the spare FMC; 
incrementing the sync counter of the determin- 
ing FMC; inducting the master FMC senrjng 
synchronization data to the ^pare FMC rf the 
sync counter of the determining FMC is zero or 
the sync counter d the FMC does not equal the 
sync counter of tie spare FMC, wherein the 
sync counter of the determining FMC is incre- 
mented after all sync data has been sent to the 
spare FMC. 

7. The method claimed in claim 15 including the 
spare FMC; 

determining rf new data has been sent form the 
master FMC; 

- rf new data has been sent from the master 
FMC, forwarding the data to the object manag- 
ers of the spare FMC; and 

- after the data has been sent to the object man- 
agers of the spare FMC, setting the sync coun- 
ter of the spare FMC equal to the sync counter 
of the master FMC. 

& A system for choosing which flight management 
computer (FMC) of a pair of FMCs wffl function as a 
master FMC and which will function as a spare 
FMC and maintaining data commonalty and syn- 
chronization between the master FMC and the 
spare FMC, said improvement including: 

- each of said FMCs inducing a master/spare 
determination subroutine for determining if one 
of said fight management computers has failed 

. and choosing the other of said FMCs to func- 
tion as a master FMC if one of said FMCs has 
faded and the failed FMC to function as a spare 
FMC; and 

a sync protocol for controlling the transfer of 
data received by the FMC chosen to function 
as the master FMC form pilot inputs to the FMC 
chosen to function as the spare FMC while 
inhibiting the FMC chosen to be the spare FMC 
from processing received data from said pilot 
inputs, and syrKhrorusing the FMC chosen to 
be the spare FMC to the FMC chosen to be the 
master FMC. 

9. The system daimed in claim 8, wherein said 
master/spare determination subroutine includes: 
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deter: nhring rf said FtfCs^re h earthy; 

- determining if a selected one of said FMCs is 
claiming to be a master FMC; 

- choosing said selected one of said FMCs to 
function as said master FMC and the other 
FMC to function as said spare FMC if both of 
said FMCs are heatthy and if said selected one 
of said FMCs is claiming to be a master FMC; 
wherein said master/spare determination sii>- 
routine also includes; 

- if both of said FMCs are heatthy and if said 
selected one of said FMCs is not claiming to be 
a master FMC, determining if said selected one 
of said FMCs is claiming to be a spare FMC; 
and 

- choosing said selected one of said FMCs to 
function as said spare FMC and the other FMC 
to function as said master FMC if both of said 
FMCs ar healthy and H said selected one of 
said FMCs is claiming to be a spare FMC. 
wherein said master/spare determination sub- 
routine also includes: 

- choosing the other of said FMCs to function as 
said master FMC if the health of one of said 
FMCs has degraded and choosing the FMC 
whose health has degraded to function as said 
spare FMC, wherein said master/spare deter- 
mination subroutine also includes; 

- determining "rf a selected one of said FMCs is 
claiming to be a master FMC if the health of 
both of said FMCs has degraded; and 

- choosing said selected one of said FMCs to 
function as said master FMC and the other 
FMC to function as said spare FMC if the 
health of both of said FMCs has degraded if 
said selected one of said FMCs is claiming to 
be a master FMC. 

10. The system claimed in claim 8 or 9, wherein the 
sync protocol comprises each FMC; 

- determining if the determining FMC is master 
FMC, 

- if the determining FMC is a master FMC, deter- 
mining if the other FMC is alive; 

- if the other FMC is not afive, setting a sync 
counter in the determining FMC; 

- if the determining FMC is not a master FMC; 
determining if the determining FMC is a spare 
FMC; 

- if the other FMC is not afive. setting a sync 
counter in the determining FMC. wherein the 
sync protocol includes the master FMC: 

- determining if the sync counter of the determin- 
ing FMC is zero if the sync counter of the FMC 

' does not equal the sync counter of the spare 
FMC; 

- if the sync coulter of the determining FMC is 
not zero, and the sync counter of the master 
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FMC equals the sync counter of the spare 
FMC, determining if the master FMC has 
updated data; 

if the master FMC has updated data, sencfing 
the updated data to the spare FMC; 
incrementing the sync counter of the determin- 
ing FMC; wherein the sync protocol I includes 
the master FMC sending synchronization data 
to the spare FMC if the sync counter of the 
determining FMC is zero or the sync counter of 
the master FMC does not equal flie sync coun- 
ter of spare FMC. 
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